Method and Apparatus for Reclassifying E-mail or Modifying a Spam Filter Based on Users&#39; Input

ABSTRACT

A method is disclosed including passing a plurality of e-mails through a spam filter and classifying at least of the plurality of e-mails as not spam. Thereafter, the plurality of e-mails are received at each of a plurality of user computers. The method may further include receiving a plurality of reports, the plurality of reports including one report from each of the plurality of user computers that one or more of the plurality of e-mails are spam that was not classified as spam by the spam filter. Based on the plurality of reports, one or more of the plurality of e-mails is reclassified as spam and/or the spam filter is modified.

This application is a continuation of U.S. patent application Ser. No.12/333,711, filed Dec. 12, 2008, the disclosure of which is hereinincorporated by reference in its entirety.

FIELD

The disclosed technology relates to electronic mail (e-mail) and moreparticularly to the classification and/or filtering of e-mail as spam ornot spam.

BACKGROUND

Spam is generally defined as unwanted and unsolicited e-mail. Each daythousands of e-mail systems, such as Simple Mail Transfer Protocol(SMTP) mail systems, controlled by spammers, connect or attempt toconnect to mail servers of large Internet Service Providers (ISPs) totransmit spam. The Internet Service providers may attempt to blocke-mail from an Internet Protocol domain or address that is recognized asa spammer and is on a known blacklist. In addition, the Internet Serviceproviders typically have spam filters, which attempt to eliminate or atleast reduce, the amount of spam which gets through to user computers,or which is unintentionally classified as not spam.

Internet Service Providers first focus their efforts on either obtainingspam filtering rules from a vendor or developing their own from analysisof spam messages. Secondly, ISPs either obtain a spam Internet Protocolblacklist from a vendor, or they compile their own by analyzing “verdictresults”, arriving at a reputation for each mail system or IP addresssender and establishing thresholds to be used to determine whether aparticular mail system's IP address should be added to their blacklist.“Verdict results” are determinations of whether an e-mail message isclassified as spam or not spam by a spam filter. Internet ServiceProviders (ISPs) generally analyze all verdict results for all e-mailoriginating from a sending IP address to determine a reputation for thatsending IP Address.

More specifically, the operation of the blocking and filtering processis as follows. When an originating mail system or IP address senderattempts to transmit email to a destination mail system, the originatingIP address is first checked against a whitelist and then against ablacklist. If the IP address is on the whitelist, the connection andassociated messages are accepted. Whitelists are compiled by analyzinghistorical data to identify trusted mail systems, by including mailsystem IP lists supplied by trusted companies, and by analyzing blockingcomplaints to identify trusted mail system. If a connection is accepted,the e-mail message is passed to a filtering process or spam filter todetermine if it is spam. If the message is determined to be spam by thespam filter, then the message is either quarantined or deleted. If themessage is determined not to be spam, the message is sent to therecipient's post office inbox on a mail server. E-mail that isidentified as spam by a mail server of an Internet Service provider maybe placed in a user's post office spam folder. A user can downloade-mail from either a user's post office inbox or from a user's postoffice spam folder onto the user's computer or client computer.

If the originating IP address is on a blacklist, the connection andassociated messages are rejected. An error is returned on rejectedconnections and, in many cases a non-delivery notice is sent back to theoriginator of a rejected message.

A problem with such prior solutions is that spammers can easily sendspam that gets past the blacklists and spam filters. They send spam froma vast number of different IP addresses that have no reputation or atleast not a bad reputation. They modify their spam messages as often asthey need in order to get a sufficient amount of spam through thefilters. They test their spam messages prior to initiating an attack toinsure it is sufficient. As a result, ISPs are constantly updating theirblacklists and their filtering rules after the fact with the hope thatit may mitigate the next attack. Sometimes it takes hours to days to beable to identify and create new filters to catch the new spam and as aresult most of the spam from a specific attack may get past the filters.It is delivered to the ISP's post office, waiting to be requested by theuser to be either read by an online email client or delivered to theirpersonal computer email client.

The effectiveness of the current filtering process is limited because itis very hard to mitigate attacks by simply filtering spam messages afterthe fact. Spammers easily change or randomize the content of the spammessages to by-pass even the best spam filters. Additionally, spammerscan execute test spam attacks to determine whether their spam messagesfor a specific spam attack will get past the filtering defenses. Even ifa high percent of the spam gets filtered out, the spammers will increasetheir volume until they get a sufficient amount of spam through thefilters.

As a result of not being able to identify sufficient spam to meetthresholds that ISPs have set up to block malicious mail systems, manyISPs lower their blocking thresholds, which lowers their confidence withtheir blocking decisions. This can cause an increase in the blocking oflegitimate mail systems or IP address senders and an increase incomplaints to their care centers.

Over the last several years, a larger and larger proportion of the spamthat is sent by spammers is getting by Internet Service Providers'defenses, and being delivered into user's post office inbox. It hasgotten to the point where sometimes close to 100% of all spam receivedduring a specific spam attack from a spammer is getting through theISP's defenses. It is common for large ISPs to receive five hundredmillion spam messages each day, transmitted from tens of millions ofunique Internet Protocol (IP) addresses, many of which have never beforeconnected to the Internet Service Provider.

As a result of being unsure of the sender's identity, the lack ofreputation, the ever increasing difficulty with ascertaining whether amessage is spam, and the increasing effectiveness of spammers, ISPs havehad a hard time improving the effectiveness of their current spamblocking and filtering processes. As a consequence, spam is increasinglybeing delivered to the ISP subscribers' post office inboxes and hassignificantly and adversely affected their experience with using e-mail.In addition, from an ISP's perspective, it has greatly affected the costof providing service.

Spammers need to get their spam past the ISP blocking and spam filteringdefenses and into many users' post office inboxes in order for users toconsider purchasing their products. To obtain maximum selling potential,spammers have to send spam to millions of user's email addresses on avast number of ISPs. Spam that has gotten past blocking and filteringdefenses and deposited in a user's post office inbox is commonly called“missed spam”.

There are various devices known in the prior art for filtering e-mailand/or classifying e-mail as either spam or not spam. U.S. Pat. No.7,219,148 to Routhwaite et. al. discloses a feedback loop for spamprevention. Users, known as “spam fighters” receive unfiltered e-mailmessages and identify them as either spam or not spam. The feedback fromthe “spam fighters” is used to train improved spam filters.

SUMMARY

One embodiment of the disclosed technology involves transmitting anemail, classified at a spam filter as not-spam-email, to each of aplurality of user computers; receiving at least one report from at leastone of the plurality of user computers that the not-spam-email is spam;and based at least on the report, reclassifying the not-spam-email asspam.

In another embodiment of the disclosed technology, a plurality ofe-mails are passed through a spam filter on a mail server and classifiedby the spam filter as not spam. The plurality of e-mails are transmittedto each of a plurality of user computers after the plurality of e-mailshave passed through the spam filter. The plurality of user computers maysupply a plurality of reports to the mail server indicating that one ormore of the plurality of e-mails are “missed spam”, i.e. spam that wasnot classified as spam by the spam filter. Based on the plurality ofuser reports, one or more of the plurality of e-mails is reclassified asspam. Alternatively or additionally, the spam filter may be modified toensure that future e-mails will be classified as spam, if they areidentical to or substantially similar to the “missed spam”.

The disclosed technology, in at least one embodiment, takes advantage ofcollaborative inputs from any number of users, such as potentiallymillions of users. The input from the users can be used to determinewhether current e-mail is spam and to determine whether a specificInternet Protocol address sender should be identified as a spammer. Inone embodiment, e-mail that has arrived at a user's post office inboxand has been classified as not spam, but has not been delivered to auser's mailbox, can be reclassified as spam.

The step of classifying each of the plurality of e-mails as not spam mayinclude placing each of the plurality of e-mails in a user's post officeinbox. The step of reclassifying the one or more of the plurality ofe-mails as spam may include moving the one or more of the plurality ofe-mails from a user's post office inbox to a user's post office spamfolder.

After the plurality of e-mails have passed through the spam filter andhave been classified as not spam, a first set of information may bestored on a mail system to indicate that the one or more of theplurality of e-mails are not classified as spam. After receiving theplurality of reports, a second set of information may be stored on themail system to indicate that the one or more of the plurality of e-mailsare classified as spam, and the first set of information may be deleted.One or more acknowledgement messages may be sent from a mail server toone or more user or client computers of the plurality of user computers,wherein each of the acknowledgement messages provide informationconcerning the reclassifying of the one or more of the plurality ofe-mails as spam.

The spam filter may be located on a mail server computer, theclassifying of each of the plurality of e-mails as not spam may occur onthe mail server computer, the plurality of reports may be received bythe mail server computer, and the reclassifying of the one or more ofthe plurality of e-mails as spam may occur on a mail server computer.The server computer may be a mail system.

Each of the plurality of e-mails may have a message header. Inaccordance with an embodiment of the disclosed technology an originatingInternet Protocol address, a recipient e-mail address, and a messageidentification may be inserted into the message header to form amodified message header, prior to passing the plurality of e-mailsthrough the spam filter. The modified message headers may be stored in amessage database on the mail server computer.

After reclassifying the one or more of the plurality of e-mails as spam,an entry may be stored in a users' reputation database to indicate thata user has correctly reported spam that was not classified correctly bythe spam filter.

The method may also include modifying the spam filter, based on theplurality of reports from the plurality of user computers, so that whenthe plurality of e-mails are passed through the spam filter, theplurality of e-mails will be classified as spam.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a diagram of an apparatus for use in accordance with anembodiment of the disclosed technology;

FIG. 2 shows a flow chart of a method of reclassifying spam;

FIG. 3 shows a flow chart of a method of inserting various informationinto an e-mail message header;

FIG. 4 shows a flow chart of a method of raising or lowering a user'sreputation based on correctly or incorrectly identified spam;

FIG. 5 shows a high level block diagram of a computer; and

FIG. 6 shows a block diagram of various databases which may be part ofcomputer memory of a mail server in accordance with an embodiment of thedisclosed technology.

DETAILED DESCRIPTION

FIG. 1 shows a diagram of an apparatus and/or system 100 for use inaccordance with an embodiment of the disclosed technology. The apparatus100 includes a mail server 102, the internet 104, a first user or clientcomputer 106, and a second user or client computer 108. The mail server102, the first user computer 106, and the second user computer 108 maybe connected by communications links to the internet 104. Thecommunications links may be any type of communications links such aswireless, wired, optical, etc. Although only two user computers 106 and108 are shown in FIG. 1, in practice many more user computers, such asmillions of user computers, would be connected to the internet 104, andwould be used in accordance with one or more embodiments of thedisclosed technology.

The mail server 102 may include a computer memory, such as mail servercomputer memory 600 shown in a block diagram of FIG. 6. The mail servercomputer memory 600 may include a message database 602 for storinge-mails or e-mail messages, a users' reputation database 604 for storingdata related to users' reputations for correctly identifying “missedspam”, a missed spam reports database 606 for storing reports of “missedspam”, and an IP address sender reputation database 608 for storing datarelating to the reputations of particular IP address senders of e-mail.The mail server computer memory 600 may also include post office inboxes610 for all users and post office spam folders 612 for all users.

FIG. 2 shows a flow chart 200 of a method of an embodiment of thedisclosed technology. At step 202 a plurality of e-mails are passedthrough a spam filter on a mail server, such as mail server 102 inFIG. 1. The mail server 102 may be a computer, such as a computer 500,as will be described with reference to FIG. 5. The spam filter mayclassify each of the plurality of e-mails as not spam and permit thoseemails that are not spam to pass the filter. The mail server may be acomputer and the spam filter may be implemented by a computer processorand a computer memory of the mail server 102. At step 204, the pluralityof e-mails are received at each of a plurality of user computers, suchas the first user computer 106 and the second user computer 108 shown inFIG. 1, after the plurality of e-mails have passed through the spamfilter of the mail server 102.

Users, such as an individual at the first user computer 106 and anindividual at the second user computer 108, may believe that one or moreof the plurality of e-mails are “missed spam”, i.e. spam which has beenpassed through as not spam by the spam filter of the mail server 102. Auser, such as a user at first user computer 106 or second user computer108, may send a report in to the mail server 102 to indicate that one ormore of the plurality of e-mails was “missed spam”. At step 206 aplurality of reports may be received at the mail server 102, each reportfrom a user computer, such as 106 and 108, indicating that one or moreof the plurality of e-mails are spam that was not classified as spam bythe spam filter. The plurality of reports may be stored in the missedspam reports database 606 of the mail server computer memory 600 shownin FIG. 6 of mail server 102 shown in FIG. 1.

On reception of a report of “missed spam” at step 206, the InternetService Provider may log the submission including in one embodiment a“message-id”, “originating-ip”, and “recipient email address” in themissed spam reports database 606 of mail server computer memory 600 ofthe mail server 102. Duplicate or non-existent entries, based onmessage-id checking, are not logged into the missed spam reportsdatabase 606. Spammers, in general, have email accounts on ISPs or havecompromised other user accounts and will attempt to poison the input ofthe missed spam reports database 606. The mail server 102, in oneembodiment, checks the missed spam reports from the user computersagainst the message database 602, such as on the mail server computermemory 600 of the mail server 102. This will stop or reduce poisoningattempts and may identify spamming accounts or user accounts that havebeen compromised. This checking will also stop upset users from enteringmultiple missed spam reports or submissions. Old, stale entries are notadded to the missed spam reports database 606 both because the value ofthese entries has diminished and to control storage needs.

Based on the plurality of reports submitted to the missed spam reportsdatabase 606, one or more of the plurality of e-mails is reclassified asspam by the mail server 102 and/or the spam filter of the mail server102 is modified at step 208. The spam filter may be implemented by acomputer processor and/or computer memory of the mail server 102. Thespam filter may be modified so that if a new e-mail identical to orsimilar to the “missed spam” e-mail is received by the modified spamfilter the new e-mail will be properly identified as spam.

An e-mail sender or IP address sender may have its reputation lowered orraised in an IP address sender reputation database 608 of the mailserver computer memory 600 of mail server 102. For an IP address sender,a check may be done to determine whether the IP address has surpassedthe threshold for blocking e-mails from that IP address. There is someneed for bootstrapping to get this process started. If the threshold hasbeen surpassed, the IP address is checked against a whitelist and if theIP is on the whitelist, in one embodiment it is not blocked. If the IPis not on the whitelist, in one embodiment of the disclosed technologyit is immediately added to the blacklist, and then e-mails from that IPaddress will be automatically blocked. If an IP address is blacklisted,then an entry may be added to the users' raising the reputation for eachuser that submitted a reported missed spam entry for this IP addresssender.

If an IP address is determined to be blacklisted by this process, acheck is then made, by the mail server 102 in one embodiment, againstthe Message Database 602 to identify all messages that have beenrecently sent by this IP address and are still residing in the postoffice Inboxes 610 on the mail server 102. Once the messages have beenidentified, their status is checked to determine whether they have beenread or delivered. If they haven't been read or delivered, then themessages are moved from the user's post office Inbox from post officeInboxes 610 on the mailer server 102 to the user's post office spamfolder of post office spam folders 612 of mail server computer memory600. This greatly extends the ability by Internet Service Providers tofilter spam after it has gotten past its blocking and filteringdefenses, but before a user has read it. Spam attacks occur somewhatrandomly throughout the day and are targeted at different users. Usersread their mail at different times throughout the day, but in general,they only read it a couple of times each day. With restrictivethresholds, blocks initiated as a result of missed spam reporting aretimely. As a result, some users will report missed spam which causes anIP to be blacklisted, which in turn causes all missed spam from theattack to be filtered from other user's mailboxes before they have had achance to read it. The impact of the current and future attacks will bemitigated and will improve the overall effectiveness of the ISPs spammitigation defenses.

A button, field, or toolbar having a designation or indication of thewords “missed spam” may be provided in each of the e-mails or e-mailmessages that are sent to the user, and such button, field or toolbarmay be displayed on a computer monitor of a user computer, such ascomputer 106. In one embodiment of the disclosed technology a user canclick on the “missed spam” button or field using a computer mouse or acomputer touch screen, in order to report missed spam. The processingfor the “missed spam” field, button, or toolbar may be provided througha user or client computer application or help program on a usercomputer, such as first user computer 106.

FIG. 3 shows a flow chart 300 of a method of inserting variousinformation into an e-mail message header in accordance with one aspectof the disclosed technology. The various information may be insertedinto an e-mail message in response to the reception of an e-mail messageat a mail server 102 or in response to a user clicking on a button,field or toolbar on a user computer, such as user computer 106, having adesignation of “missed spam”. In the prior art, e-mails typically have amessage header, which is located at the top of the message before themessage content. The prior art e-mail message header contains routinginformation of the mail systems the e-mail message transverses, as wellas, some address and message information. However, message headers inthe prior art do not include an originating IP address, messageidentification, or recipient e-mail address for the particular e-mailmessage or missed spam reports in accordance with the disclosedtechnology of the present application.

At step 302 of the method shown in FIG. 3, an e-mail or e-mail messageis received, such as at mail server 102. An originating IP address forthe e-mail message, a message identification, and a recipient e-mailaddress is inserted into the e-mail message header at step 304. Theoriginating IP address, message identification, and recipient e-mailaddress could be inserted automatically at the mail server 102. In oneembodiment of the disclosed technology, the originating IP address isobtained from the TCP/IP (Transmission Control Protocol/InternetProtocol) connection during SMTP (Simple Mail Transfer Protocol) sessionestablishment. The message identification is a unique identifier foreach specific message that is assigned by mail server 102. The recipiente-mail address is supplied by the originating mail system as the addressto be the recipient of this email message. At step 306, the e-mail withmodified e-mail message header is sent to the spam filter, such as thespam filter of the mail server 102, which may be used in the methodshown in FIG. 2. The e-mail message prior to modification of the messageheader or after the modification of the message header may be stored incomputer memory of the mail server 102.

At step 308 of the method shown in FIG. 3, a user clicked on a button,field or toolbar on a user computer, such as user computer 106,designating the email as “missed spam”. The recipient e-mail address, inone embodiment of the disclosed technology, is obtained from logincredentials of the sender of the missed spam report who is authenticatedand just submitted the “missed spam report”. The authenticated recipiente-mail address is then inserted into the header of the missed spamreport, which already contains the originating IP address and themessage identification at step 310 at the mail server 102. At step 312,the e-mail with modified missed spam report header is sent to update themail server computer memory 600 in FIG. 6 of the mail server 102. Themissed spam report prior to modification of the message header or afterthe modification of the header may be stored in computer memory 600 ofthe mail server 102.

In the prior art, when e-mail messages arrive at a mail server, thee-mail messages themselves normally already have an originating IPaddress in a message header in message routing information for thee-mail message. However, this originating IP address cannot be trusted,because spammers may have, and do, modify message headers of their spame-mail messages. Therefore, in accordance with an embodiment of thedisclosed technology, the field already provided with an originating IPaddress in the message header is not used. Instead, in at least oneembodiment of the disclosed technology the originating IP address for aTCP/IP connection that is used to establish an SMTP session is used. Inone embodiment of the disclosed technology, this TCP originating IPaddress is inserted as a separate field in a message header for theparticular e-mail message.

When a member sends a “missed spam report” in, it may be poisoned by aspammer, i.e. it may be a bogus missed spam report. To determine if themissed spam report is bogus or poisoned, the mail server, such as mailserver 102, may examine who is sending the report by looking at logincredentials of the missed spam report sender who in one embodiment isauthenticated and just submitted the “missed spam report”. Additionally,instead of using the recipient email address in the message header, oneembodiment of the disclosed technology may include inserting anauthenticated recipient e-mail address into the “missed spam report”during transport from the reporter to the mail server, such as mailserver 102. The mail server 102 may extract the originating IP address(that was inserted earlier in the e-mail which is now being identifiedas “missed spam). The inserted originating IP address for the allegedlymissed spam, should be in the message header of the allegedly missedspam e-mail, unless it was deleted or changed by spammers. In some casesthere may legitimately be multiple originating IP addresses, such aspossibly when one e-mail is forwarded to another address. In accordancewith an embodiment of the present invention, the unique messageidentification (which was added to the e-mail message) is extracted andused to map to the original e-mail message that was processed by themail server 102 through its spam filter. However, it is possible that aspammer may have figured out how the uniquely assigned messageidentifications are determined, so in one embodiment the mail server 102is programmed to check the unique message identification along with theinserted originating IP address, and inserted recipient address againstvalues stored in a Message database, such as message database 602, shownin FIG. 6.

At step 302 of the method shown in FIG. 3, an e-mail or e-mail messageis received, such as at mail server 102 or at user computer 106 ofFIG. 1. An originating IP address for the e-mail message, a messageidentification, and a recipient e-mail address is inserted into thee-mail message header at step 304. The originating IP address, messageidentification, and recipient e-mail address could be insertedautomatically at the mail server 102, or could be inserted in responseto a user clicking on a button, field, or toolbar designated “missedspam” on a user computer, such as 106. At step 306, the e-mail withmodified e-mail message header is sent to the spam filter, such as thespam filter of the mail server 102, which may be used in the methodshown in FIG. 2. The e-mail message prior to modification of the messageheader may be stored in computer memory of the mail server 102 or theuser or client computers 106 and 108 and the e-mail message with themodified message header may also be stored in computer memory of themail server 102 or the user or client computers 106 and 108.

FIG. 4 shows a flow chart of a method of raising or lowering a user'sreputation based on correctly or incorrectly identified missed spam inaccordance with an aspect of the disclosed technology. At step 402 themail server 102 determines whether a user, such as first user computer106, correctly identified missed spam. If the answer is no, then theuser's reputation is lowered at step 404, such as by making anappropriate entry into the users' reputation database 604 in computermemory 600 shown in FIG. 6 of the mail server 102 shown in FIG. 1. Ifthe answer if yes, then the user's reputation is raised, such as bymaking an appropriate entry into a users' reputation database 604 incomputer memory 600 of the mail server 102. If the user has correctlyidentified missed spam, then the mail server 102 may send the user, suchas the user computer 106, an acknowledgement at step 408. Theacknowledgement may be a message which thanks the user for theassistance in identifying spam. For the ISP to keep its customerssatisfied, it is important that the ISP, such as mail server 102,respond back to the user computer, such as 106, that the ISP heard theuser's complaint, are doing something to improve the ISP's defenses, andacknowledge that the mitigation improvements are as a direct result ofthat user's input.

Upon reception of a missed spam report at mail server 102 from a user,entries or data concerning the users' reputation, which is contained inthe users' reputation database 604, is checked. If the user has noreputation (i.e. not data concerning reputation), insufficientreputation (not enough data) or a bad reputation (data indicating a badreputation), an entry may not be added to the IP address senderreputation database 608 in computer memory 600 of the mail server 102.If the user correctly identified the missed spam, then the user'sreputation is raised by appropriate data entry into the user'sreputation database 604 and then subsequent missed spam reports maybegin to be used to lower or raise the IP address sender's reputation byappropriate data entry in IP address sender reputation database 608.

A high-level block diagram of a computer 500 that may be used inpracticing the disclosed technology is illustrated in FIG. 5. Each ofthe mail server 102, the first user computer 106, and the second usercomputer 108 may be a computer similar to or identical to the computer500. Computer 500 contains a processor 504, which controls the overalloperation of the computer 500 by executing computer programinstructions, which define such operation. The computer programinstructions may be stored in a storage device 510 or other computerreadable medium (e.g., magnetic disk, CD ROM, etc.), and loaded into amemory 506 when execution of the computer program instructions isdesired. Thus, the method steps of FIGS. 2-4 can be defined by thecomputer program instructions stored in the memory 506 and/or storagedevice 510 and controlled by the processor 504 executing the computerprogram instructions. For example, the computer program instructions canbe implemented as computer executable code programmed by one skilled inthe art to perform an algorithm defined by the method steps of FIGS.2-4. Accordingly, by executing the computer program instructions, theprocessor 504 executes an algorithm defined by the method steps of FIGS.2-4. The computer 500 also includes one or more network interfaces 508for communicating with other devices via a network. The computer 500also includes input/output devices 502 that enable user interaction withthe computer 500 (e.g., display, keyboard, mouse, speakers, buttons,etc). One skilled in the art will recognize that an implementation of anactual computer could contain other components as well, and that FIG. 5is a high level representation of some of the components of such acomputer for illustrative purposes.

Users generally have a good idea of whether an email message theyreceive in their mailbox is spam or a legitimate email. In addition,users want to tell their e-mail provider, ISP, that the ISP missed thisspam message. One or more embodiments of the disclosed technologyprovide an easy way to facilitate communication from a user's emailclient or user computer, such as user computer 106, back to the ISP ormail server, such as mail server 102, that a spam message was missed.This collaborative input may be used as the means to determine thereputation of the mail system or sending IP address and whether aparticular sending IP address should be added to a “blacklist”, i.e. alist of IP addresses from which communications or connections will notbe accepted.

One or more embodiments of the disclosed technology can be used inconjunction with current spam blocking and filtering processes. Forexample, a “whitelist”, as known in the prior art, can be used. When anoriginating e-mail system attempts to transmit e-mail to a destinationmail system, the originating IP address may be first checked against a“whitelist”. The “whitelist” includes IP addresses from whichconnections are allowed, but e-mail messages are still subject to a spamfilter. The e-mail can also be checked against a “blacklist” from whichno communications or connections are accepted.

If a connection is accepted from a sender or IP address, instead of justpassing the e-mail message to a spam filtering process, the originatingIP address (“Originating IP”) may be inserted in an existing messageheader of the e-mail (for example: X-Originating-IP: [111.22.333.44]), amessage identification (“Message-id”) is also inserted in the messageheader, and an entry may be logged in the message database 602 incomputer memory 600 of the mail server 102, including the “Message-Id”,“Originating-IP”, and “Recipient e-mail address”. The e-mail message maybe passed to the spam filtering process as shown in step 202 in FIG. 2and if determined not to be spam, it may be deposited in the recipient'spost office Inbox of post office inboxes 610 on the mail server 102,with status of unread or undelivered.

The user then either reads the message using an online email clientcomputer or user computer, such as user computer 106, or requestsdelivery of the message to their personal computer (PC) email client,such as user computer 106. The message status is then changed to read ordelivered.

In one embodiment of the disclosed technology, the ISP, such as mailserver 102, will get input or reports of “missed spam” from tens ofmillions of independent users on their determinations of tens ofmillions of spam messages every day. This is very valuable inidentifying spam that is missed by current defenses and in identifyingthe sources of the spam attacks. Spammers can test their spam attacksagainst filtering rules that the ISP use in order to improve theeffectiveness of their spam attack, but spammers can't test them againsttens of millions of user's visual, non-biased, ever changing, subjectivedeterminations.

As with all social, collaborative efforts it is important to sustaininput. Spammers will most likely continue to send spam, ISPs blockingand filtering efforts will continue to allow spam to be delivered intouser's mailboxes, and users will complain or report missed spam. Inorder to help sustain user input, the ISP may include results and thanksfor this collaborative effort in their newsletters and also provide, aspart of the reported missed spam submissions, real-time statistics onhow many successful missed spam submissions were sent so far today, andhow many total spam messages were filtered as a direct result of theirinput. Recognizing the efforts of the users, individually or as a whole,will help sustain this process.

The foregoing Detailed Description is to be understood as being in everyrespect illustrative and exemplary, but not restrictive, and the scopeof the invention disclosed herein is not to be determined from theDetailed Description, but rather from the claims as interpretedaccording to the full breadth permitted by the patent laws. It is to beunderstood that the embodiments shown and described herein are onlyillustrative of the principles of the present invention and that variousmodifications may be implemented by those skilled in the art withoutdeparting from the scope and spirit of the invention. Those skilled inthe art could implement various other feature combinations withoutdeparting from the scope and spirit of the invention.

1. A method comprising: determining whether a user computer correctlyidentified an email which was classified at a spam filter asnot-spam-email; in response to determining that the user computercorrectly identified the email, raising a reputation of the usercomputer; and in response to determining that the user computerincorrectly identified the email, lowering the reputation of the usercomputer.
 2. The method of claim 1, further comprising: in response tothe determining that the user computer incorrectly identified the email,determining that the reputation of the user computer is indicated as abad reputation; and identifying the user computer as having beencompromised.
 3. The method of claim 1, further comprising: determiningthat the email is spam in response to determining that the user computercorrectly identified the email as missed spam; reclassifying the emailas spam; and moving the email from a user's post office inbox to auser's post office spam folder.
 4. The method of claim 3, furthercomprising: sending a message to the user computer, wherein the messageprovides information concerning the reclassifying the email as spam. 5.The method of claim 1, further comprising: inserting an originatinginternet protocol address, a recipient e-mail address, and messageidentification in a message header of the email; and storing the messageheader of the email into a message database on a server computer.
 6. Themethod of claim 1, further comprising: determining that the email isspam; determining that the user computer correctly identified the emailas missed spam; and lowering a reputation of an internet protocoladdress sender associated with the email.
 7. The method of claim 6,further comprising: adding an internet protocol address associated withthe internet protocol sender to a blacklist; identifying all emails thathave been sent by the internet protocol address and are residing in apost office inbox of a particular user computer; checking the status ofthe emails to determine whether they have been read; and if they havenot been read, moving the emails from a post office inbox of theparticular user computer to a post office spam folder of the particularuser computer.
 8. An apparatus comprising: a processor; and a memory tostore computer program instructions, the computer program instructionswhen executed on the processor cause the processor to perform operationscomprising: determining whether a user computer correctly identified anemail which was classified at a spam filter as not-spam-email; inresponse to determining that the user computer correctly identified theemail, raising a reputation of the user computer; and in response todetermining that the user computer incorrectly identified the email,lowering the reputation of the user computer.
 9. The apparatus of claim8, the operations further comprising: in response to the determiningthat the user computer incorrectly identified the email, determiningthat the reputation of the user computer is indicated as a badreputation; and identifying the user computer as having beencompromised.
 10. The apparatus of claim 8, the operations furthercomprising: determining that the email is spam in response todetermining that the user computer correctly identified the email asmissed spam; reclassifying the email as spam; and moving the email froma user's post office inbox to a user's post office spam folder.
 11. Theapparatus of claim 10, the operations further comprising: sending amessage to the user computer, wherein the message provides informationconcerning the reclassifying the email as spam.
 12. The apparatus ofclaim 8, the operations further comprising: inserting an originatinginternet protocol address, a recipient e-mail address, and messageidentification in a message header of the email; and storing the messageheader of the email into a message database on a server computer. 13.The apparatus of claim 8, the operations further comprising: determiningthat the email is spam; determining that the user computer correctlyidentified the email as missed spam; and lowering a reputation of aninternet protocol address sender associated with the email.
 14. Theapparatus of claim 13, the operations further comprising: adding aninternet protocol address associated with the internet protocol senderto a blacklist; identifying all emails that have been sent by theinternet protocol address and are residing in a post office inbox of aparticular user computer; checking the status of the emails to determinewhether they have been read; and if they have not been read, moving theemails from a post office inbox of the particular user computer to apost office spam folder of the particular user computer.
 15. A computerreadable medium storing computer program instructions, which, whenexecuted on a processor, cause the processor to perform operationscomprising: determining whether a user computer correctly identified anemail which was classified at a spam filter as not-spam-email; inresponse to determining that the user computer correctly identified theemail, raising a reputation of the user computer; and in response todetermining that the user computer incorrectly identified the email,lowering the reputation of the user computer.
 16. The computer readablemedium of claim 15, the operations further comprising: in response tothe determining that the user computer incorrectly identified the email,determining that the reputation of the user computer is indicated as abad reputation; and identifying the user computer as having beencompromised.
 17. The computer readable medium of claim 15, theoperations further comprising: determining that the email is spam inresponse to determining that the user computer correctly identified theemail as missed spam; reclassifying the email as spam; and moving theemail from a user's post office inbox to a user's post office spamfolder.
 18. The computer readable medium of claim 17, the operationsfurther comprising: sending a message to the user computer, wherein themessage provides information concerning the reclassifying the email asspam.
 19. The computer readable medium of claim 15, the operationsfurther comprising: inserting an originating internet protocol address,a recipient e-mail address, and message identification in a messageheader of the email; and storing the message header of the email into amessage database on a server computer.
 20. The computer readable mediumof claim 15, the operations further comprising: determining that theemail is spam; determining that the user computer correctly identifiedthe email as missed spam; and lowering a reputation of an internetprotocol address sender associated with the email.